CERIAS: News

Is it ‘High Noon’ for Google, China?

2010-01-26T14:51:40+00:00

“The fact that multiple very large corporations indicated they had all been victims of this … and many issued public statements and took a stand, that’s not something we’ve seen before,” said Eugene Spafford, a computer security specialist at Purdue University who has advised two U.S. presidents and numerous companies and government agencies.

More information »

Scammers target givers after Haiti earthquake

2010-01-14T18:34:45+00:00

Professor Spafford describes how events like the recent earthquake in Haiti bring out con artists and scammers, and how to avoid them.

WEST LAFAYETTE, Ind. - The earthquake Tuesday (Jan. 12) in Haiti caused massive destruction with widespread loss of life and property. The stories and pictures over the next few days and weeks will undoubtedly trigger the urge in people to make contributions to help.

“Unfortunately, these events also bring out the con artists and scammers who are more interested in making money for themselves rather than contributing to the rescue and restoration efforts,” said Eugene H. Spafford, professor and executive director of CERIAS (Center for Education and Research in Information Assurance and Security) at Purdue University.

Researchers at CERIAS know that criminals will take advantage of the most tragic of circumstances and exploit the sense of urgency people have to “do something” in order to overcome their normal caution.

“Our past research showed that the same people who normally commit fraud with get-rich-quick e-mails adjust their scams - within a matter of hours - to act as victims of these tragedies,” said Howard Sypher, a professor with CERIAS and head of the Department of Communication. “Web sites are undoubtedly already constructed to impersonate major charities and thus trick the unwary.”

Spafford cautions that fraudulent calls for aid could come in many forms.

“Be alert for fraudulent but sincere-sounding appeals for aid from Haitian victims, from what appear to be charities, or from government or U.N. officials,” he advises. “These solicitations may be sent as e-mail to you or a group to which you belong, as postings or messages on a social newsgroup such as Facebook or Twitter, as a phone call from someone soliciting donations, or as a Web site to which you are directed or that pops up when visiting a site.”

Both professors emphasized that, based on their past experiences, some of these fraudulent appeals will sound convincing, and the associated Web pages will appear official and legitimate.

Here are some tips from the experts at CERIAS on how to avoid being scammed, now and at other times:

Do not enter any information at a Web page that pops up unexpectedly when you visit some other site.
Never click on a Web site address (URL) in e-mail sent to you; it may look official, but most will be pointers to fraud or attack sites.
Don’t assume that every Web address returned by a search engine, such as Google or Bing, is a legitimate organization.
Do not respond to e-mail requesting donations or making a special offer (such as asking you to hold their assets while Haiti rebuilds).
Do not reveal any personal or financial information during a phone call you did not dial yourself.
If a friend forwards a URL, phone number or e-mail, don’t trust it until you check its validity. Your friend may have been scammed first.

How do you find a real charity to which you can contribute? Spafford recommends one starting point at CNN that lists real charities and how to contact them.

“Use your phone book to find the information of a nearby chapter of the American Red Cross or the Salvation Army,” Spafford said. “Call or visit them and ask how you can contribute to Haitian disaster relief. Even small donations help and will be gratefully received - by real charities, not crooks.”

CERIAS is the nation’s premier interdisciplinary academic center for research and education in information assurance, security, privacy and digital crime.

For more information, contact Eugene H. Spafford at 765-494-7825, or visit the CERIAS Web site at http://www.cerias.purdue.edu/

Writer:

Jim Bush, 765-494-2077, jsbush@purdue.edu

Sources:

Eugene Spafford, 765-494-7825, spaf@purdue.edu
Howard Sypher, 765-494-3300, hsypher@purdue.edu

CERIAS partners with industry, academic leaders to address nation’s cybersecurity threats

2009-12-01T16:44:21+00:00

CERIAS is partnering with Northrop Grumman Corp., CMU and MIT to advance research and address the nation’s most pressing cyber threats. This new consortium will work to accelerate the transfer of technology from ideas to real-life application.

Purdue University’s Center for Education and Research in Information Assurance and Security is partnering with Northrop Grumman Corp. and two other universities to advance research and address the nation’s most pressing cyber threats.

The Northrop Grumman Cybersecurity Research Consortium, involving Purdue, Carnegie Mellon University in Pittsburgh and the Massachusetts Institute of Technology in Cambridge, Mass., was announced Tuesday (Dec. 1) at the National Press Club in Washington, D.C. The group will work to accelerate the transfer of technology from ideas to real-life application.

“The Cybersecurity Research Consortium is a wonderful new initiative for CERIAS,” said Gene Spafford, the Purdue center’s executive director. “For more than 15 years, Purdue has been the leading academic group in research and education in information security. Our mission has been to build collaborative relationships with industry, government and other academic entities to advance the state of cybersecurity through basic and applied research while serving as a resource to the global community. We welcome this opportunity for new collaborations and inspirations and look forward to continuing to innovate at the forefront of information protection and privacy.”

Robert Brammer, chief technology officer for Northrop Grumman Information Systems, said Purdue was among the first institutions the corporation thought of when putting the consortium together.

“Purdue’s CERIAS is the largest academic security center in the United States and has won many awards for research and educational excellence in cybersecurity,” Brammer said. “Purdue has produced about 25 percent of the Ph.D.’s in cybersecurity in the past several years and has developed many successful security inventions.”

A motivating factor in starting the consortium was to address some of the issues in President Obama’s report last May of the threats and the need to be in front of cybersecurity issues, Spafford said. CERIAS research was referenced four times in the president’s report.

“CERIAS has long held the belief that too much of today’s information security research focuses on patching near-term problems at the expense of fixing long-term issues,” Spafford said. “The consortium enables four leading research institutions to focus on addressing the fundamental issues of information security, assurance and privacy.”

The consortium will take on some of our world’s leading cyber problems, initially sponsoring 10 projects and providing graduate student fellowships while continuing to expand the portfolio of research to cover the many different aspects of cybersecurity. Members will coordinate research projects, share information and best practices, develop curricula, author joint case studies and other publications, and provide a greater number of learning opportunities and applications for students and the defense community.

For its part, CERIAS will conduct research in four areas:

Elisa Bertino, a computer science professor and director of research for CERIAS, will examine embedding information into a digitial signal and origins of data streams for information attribution.
Bharat Bhargava, a computer science professor and CERIAS fellow, will lead research into the detection and defense against attacks in cloudlike distributed systems.
Sonia Fahmy, associate professor in computer science, will lead research into decomposing Internet-scale models to accurately perform constrained experiments.
Rick Mislan, assistant professor in computer and information technology, will lead research into fast forensics, improving the speed and fidelity of forensics in the field on cell phones, PDAs and similar devices.

CERIAS is the world’s largest multidisciplinary academic center addressing the issues of information security, assurance, privacy and cybercrime. The center involves more than 80 faculty and 100 graduate students from 18 academic departments across eight of Purdue’s colleges.

The center was spawned from the Computer Operations, Audit and Security Technology (COAST) lab that was started in 1991 within Purdue’s computer sciences department from research by professors Spafford and Samuel Wagstaff Jr. In 1998 CERIAS began with state funding to look at information security from a multidisciplinary perspective. Since then, the center has taken part in more than 200 projects with private business, agency or government funding, including a recent study for antivirus software giant McAfee Inc. that found companies lost an estimated $4.6 billion in intellectual property in 2008 as a result of cybercrime.

Spafford has worked with government, law enforcement, corporate and academic officials, including two U.S. presidents, the FBI, departments of Justice and Energy, the U.S. Air Force, Microsoft, Intel, Unisys, and the National Science Foundation. He is the 2009 recipient of the Computing Research Association’s Distinguished Service Award and has testified before Congress many times on cybersecurity.

About Northrop Grumman

Northrop Grumman is an industry leader in all aspects of computer network operations and cybersecurity. Northrop Grumman is offering customers innovative solutions to help secure the nation’s cyber future. More about cybersecurity at Northrop Grumman.

Northrop Grumman Corp. is a leading global security company whose 120,000 employees provide innovative systems, products and solutions in aerospace, electronics, information systems, shipbuilding and technical services to government and commercial customers worldwide.

Writer: Jim Bush, 765-494-2077, jsbush@purdue.edu

Source: Eugene Spafford, 765-494-7825, spaf@purdue.edu

Related release: Northrop Grumman news release

More information »

Computer Researcher Named Distinguished Fellow of Information Security Group

2009-11-19T19:27:47+00:00

Eugene H. Spafford has been named as a Distinguished Fellow of the ISSA.

Eugene H. Spafford, a professor at Purdue University and Executive Director of the Center for Education and Research in Information Assurance and Security (CERIAS), has been named as a Distinguished Fellow of the Information Systems Security Association (ISSA), the association’s highest tribute, for his leadership in foundational research in security technology, his leading role in development of influential educational programs, and his long-time advocacy and public service in information security. This follows on his earlier selection to the ISSA Hall of Fame in 2001.

Spafford is widely regarded for his ongoing efforts in cybersecurity and privacy issues. In particular, he has been recognized for his pioneering research in cyberforensics, intrusion detection, network security and firewall design, and integrity management issues, among other items. In 1998 he was the founder of CERIAS at Purdue, and helped establish the first interdisciplinary graduate degree in information security. He has also service in senior advisory roles in various professional organization and government agencies, including as chair of ACM’s US Public Policy Council (USACM), and service on the President’s Information Technology Advisory Committee (PITAC) from 2003-2005.

Over the last few decades, Spafford has been recognized with other professional distinctions, including the National Computer System Security Award in 2000, the IEEE Taylor L. Booth Award in 2004, the ACM President’s Award in 2007, and the CRA Distinguished Service Award in 2008. He has also received all three of Purdue’s major awards for excellence in teaching and education. He is a Fellow of the AAAS, the ACM, the IEEE and the (ISC)^2.

ISSA is an international association of information security practitioners who work to protect privacy, data and systems for businesses, government, education, health care and law enforcement.

ISSA’s Web site is http://www.issa.org. For more information about CERIAS, visit http://www.cerias.purdue.edu. More information on Professor Spafford is at http://spaf.cerias.purdue.edu/narrate.html.

Spafford Interviewed on IA/IS Education Issues by GovInfoSecurity.com

2009-10-20T18:14:28+00:00

Information assurance is a topic atop many agendas these days, starting with the president’s own cybersecurity initiative. But what is the state of information assurance education?

More information »

Spafford Comments on Gary McKinnon Case

2009-09-25T17:46:38+00:00

Professor Eugene Spafford, founder of the Center for Education and Research in Information Assurance and Security at Indiana’s Purdue University, said the victim of a cybercrime should not take the blame. If someone broke a door to rob a store, he said, it was usual to charge them the cost of the door.

More information »

CERIAS Prof Finds Confidential Information on State-Auctioned Computers

2009-09-25T17:44:52+00:00

Rogers found the lottery hard drives contain a list of lottery players, along with their home addresses, email addresses and birthdates; personal emails to and from lottery employees including lewd jokes and information about workers’ children; agency databases, contact lists and contracts; serial numbers and other information about lottery scratch-off and pull tab ticket machines placed in retail stores around the state; and employee usernames and passwords used to log on to state computers.

More information »

NSF awards $105m for Earthquake Engineering Center Ops HQ

2009-09-15T15:07:34+00:00

CERIAS faculty member Prof. Saurabh Bagchi to be responsible for cybersecurity

The National Science Foundation (NSF) has awarded $105 million to a Purdue-led team to spearhead a center that will serve as headquarters for the operations of the George E. Brown, Jr. Network for Earthquake Engineering Simulation, or NEES. The grant spans five years and is the largest in the university’s history. Julio Ramirez, Professor of Civil Engineering, will serve as the Director of the center and Rudi Eigenmann, Professor of Electrical and Computer Engineering will serve as the leader of the Information Technology (IT) thrust. Professor Saurabh Bagchi, Associate Professor of ECE and an active CERIAS faculty member, will be responsible for the cybersecurity of NEES hardware and software assets at the headquarters and at the 14 NEES sites around the country. The project will recruit a cybersecurity professional to work with Professor Bagchi.

Spafford Receives CRA Service Award

2009-05-08T20:12:55+00:00

Professor Eugene Spafford has been awarded the 2009 Computing Research Association (CRA) Distinguished Service Award.

This award is presented to an individual who has shown outstanding service to the computing research community. Spafford’ s selection is attributed to his role as a “tireless advocate for the cause of information security research.” The award will be presented on June 27 at the ACM Awards Banquet in San Diego.

Spafford’s current research interests are focused on issues of computer and network security, cybercrime and ethics, and the social impact of computing. He is the founder and executive director of the Center for Education and Research in Information Assurance and Security (CERIAS). This university- wide institute addresses the broader issues of information security and information assurance, and draws on expertise and research across all of the academic disciplines at Purdue.

Spafford was recently awarded the Upsilon Pi Epsilon Abacus Award and selected by the U.S. Secretary of Defense to serve on the U.S. Air Force Air University Board of Visitors.

More information »

CERIAS Students Honored by CETA

2009-05-08T17:44:26+00:00

The Committee for the Education of Teaching Assistants (CETA) honored graduate student teachers campus wide on Thursday, April 23.

During this celebration, CETA recognized Nwokedi Idika and Mohamed Fouad. Idika was a Graduate Student Honoree at the event, and Fouad received his Advanced Graduate Teacher Certificate.

Idika is a PhD student under the supervision of Prof. Bharat Bhargava. His research covers attack graphs, security metrics, and collaborative attacks.

Fouad is a PhD student, and his work focuses on data privacy, risk management, anonymity, social networks, and data utility. His research advisor is Prof. Elisa Bertino.

More information »